ContainerCodeExecutor docs say non-root, but the container runs as the image's default user (root for python:3.11-slim)

The code executor guide says:
"ContainerCodeExecutor starts a Docker container as a non-root user, with the network off and Linux capabilities dropped."

adk-python/docs/guides/code_executors/code_executor/index.md

Lines 199 to 201 in 12c7bed

    
           `ContainerCodeExecutor` starts a Docker container as a non-root user, with the 
        
           network off and Linux capabilities dropped. If you are moving off 
        
           `UnsafeLocalCodeExecutor`, this is the shortest step that puts a real boundary

The network and capability hardening is there, but containers.run doesn't set user=, and neither do the exec_run calls:

adk-python/src/google/adk/code_executors/container_code_executor.py

Lines 329 to 340 in 12c7bed

    
           self._container = self._client.containers.run( 
        
               image=self.image, 
        
               detach=True, 
        
               tty=True, 
        
               # Harden the sandbox for untrusted, model-generated code: no network 
        
               # (blocks metadata/SSRF/exfil), drop all Linux capabilities, and 
        
               # forbid privilege escalation. Networking can be re-enabled via 
        
               # `network_enabled=True` when the executed code is trusted. 
        
               network_disabled=not self.network_enabled, 
        
               cap_drop=['ALL'], 
        
               security_opt=['no-new-privileges'], 
        
           )

So the model's code runs as whatever user the image defaults to. For the image in the doc's own example (python:3.11-slim) that's root:

adk-python/docs/guides/code_executors/code_executor/index.md

Line 212 in 12c7bed

image="python:3.11-slim",

#6074 added the network and capability hardening; the user part seems to be the piece that didn't land. Maybe it's just the docs, but since this is described as the step that "puts a real boundary" between model code and the host, passing e.g. user="65534:65534" (or making it configurable) seems like the better fix than editing the sentence.

Found while testing a docs-vs-code checker I'm building (Elliot), then verified by hand.

May I send a small guide correction so it no longer promises a non-root user? The container and exec calls leave user unset, so the guide should describe the image's configured user. I would leave runtime user selection separate, since forcing a UID could affect custom images.

Thanks for confirming! I’ll open the docs PR myself today, keeping runtime user selection out of scope as you suggest.

…

On Sat, Oct 24, 2026 at 9:24 PM Samecho ***@***.***> wrote: *Samecho* left a comment (google/adk-python#7712) <#7712 (comment)> May I send a small guide correction so it no longer promises a non-root user? The container and exec calls leave user unset, so the guide should describe the image's configured user. I would leave runtime user selection separate, since forcing a UID could affect custom images. — Reply to this email directly, view it on GitHub <#7712?email_source=notifications&email_token=BXT3IQMHN7D4VG2YRX6PDM35VT6XVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZYHA2TCMBRHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6388510194>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BXT3IQPKNNWTRGCWX6WENBD5VT6XVAVCNFSNUABFKJSXA33TNF2G64TZHM4TKOBYGMYDMNJZHNEXG43VMU5TMMBRGYZTCOBRHAZ2C5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BXT3IQLTZWDUSVPJKYW3MH35VT6XVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZYHA2TCMBRHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BXT3IQK4RDVB2RHH3BQAXZT5VT6XVA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZYHA2TCMBRHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

docs: ContainerCodeExecutor runs as the image's user, not non-root

I opened #7713 before your reply came through, so both PRs now cover the same paragraph. Sorry for the crossed wires. Would you prefer to continue with #7714? I want to avoid asking the team to review the same correction twice.

No worries at all, thanks for flagging it! Yes, let’s continue with #7714 since it already has the CLA and a reviewer assigned. Would you mind closing #7713? If you want, I’m happy to add you as co-author on the commit.

…

On Sun, Oct 25, 2026 at 7:59 PM Samecho ***@***.***> wrote: *Samecho* left a comment (google/adk-python#7712) <#7712 (comment)> I opened #7713 <#7713> before your reply came through, so both PRs now cover the same paragraph. Sorry for the crossed wires. Would you prefer to continue with #7714 <#7714>? I want to avoid asking the team to review the same correction twice. — Reply to this email directly, view it on GitHub <#7712?email_source=notifications&email_token=BXT3IQOBCZ45JZLJL5OLSB35VZEPJA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMNBQGE4DANBXG4ZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6401804772>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BXT3IQJFUFNAWFO6ANNNEQ35VZEPJAVCNFSNUABFKJSXA33TNF2G64TZHM4TKOBYGMYDMNJZHNEXG43VMU5TMMBRGYZTCOBRHAZ2C5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BXT3IQMDUNRKIH2A3IJYFQT5VZEPJA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMNBQGE4DANBXG4ZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BXT3IQNGVEUGMCIBVEOIZFD5VZEPJA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMNBQGE4DANBXG4ZKM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

Navigation Menu

Repository navigation

ContainerCodeExecutor docs say non-root, but the container runs as the image's default user (root for python:3.11-slim) #7712

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	`ContainerCodeExecutor` starts a Docker container as a non-root user, with the
	network off and Linux capabilities dropped. If you are moving off
	`UnsafeLocalCodeExecutor`, this is the shortest step that puts a real boundary

	self._container = self._client.containers.run(
	image=self.image,
	detach=True,
	tty=True,
	# Harden the sandbox for untrusted, model-generated code: no network
	# (blocks metadata/SSRF/exfil), drop all Linux capabilities, and
	# forbid privilege escalation. Networking can be re-enabled via
	# `network_enabled=True` when the executed code is trusted.
	network_disabled=not self.network_enabled,
	cap_drop=['ALL'],
	security_opt=['no-new-privileges'],
	)

ContainerCodeExecutor docs say non-root, but the container runs as the image's default user (root for python:3.11-slim) #7712

Description

Activity

Samecho commented on Oct 24, 2026

EmanueleCell4 commented on Oct 24, 2026

Samecho commented on Oct 25, 2026

EmanueleCell4 commented on Oct 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions